3.3 Retain install.log for 365 or more days


macOS writes information pertaining to system-related events to the file /var/log/install.log and has a configurable retention policy for this file. The default logging setting limits the file size of the logs and the maximum size for all logs. The default allows for an errant application to fill the log files and does not enforce sufficient log retention. The Benchmark recommends a value based on standard use cases. The value should align with local requirements within the organization.

The default value has an 'all_max' file limitation, no reference to a minimum retention and a less precise rotation argument.

The maximum file size limitation string should be removed 'all_max='

An organization appropriate retention should be added 'ttl='

The rotation should be set with time stamps 'rotate=utc' or 'rotate=local'


Archiving and retaining install.log for at least a year is beneficial in the event of an incident as it will allow the user to view the various changes to the system along with the date and time they occurred.


Without log files system maintenance and security forensics cannot be properly performed.


Perform the following to ensure that install logs are retained for at least 365 days:
Edit the /etc/asl/com.apple.install file and add or modify the ttl value to 365 or greater on the file.

See Also


Item Details


References: 800-53|AU-11

Plugin: Unix

Control ID: 35043bc2678cd915d435bf10b30a8b902443f02974f268a97c45ba727202c9bb